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BY OVERNIGHT DELIVERY 


September 7, 2016 



Barbara Anthony 
Undersecretary 

Office of Consumer Affairs and Business Regulation 
Ten Park Plaza, Suite 5170 
Boston, MA 02116 

Office of Massachusetts Attorney General Maura Healey 
Attn. Sara Cable 
1 Ashburton Place 
Boston, MA 02108 

Re; Chapter 93H Notification regarding Ligris + Associates PC 

Dear Undersecretary Anthony and Assistant Attorney General Cable: 

Ligris + Associates PC (the “Company”) provides this notice pursuant to Massachusetts 
General Laws Chapter 93 H. 

The Company is writing to notify you of the inadvertent dissemination of personal 
information of two (2) Massachusetts residents. Yesterday, September 6, 2016, one of the 
Company’s paralegals sent out a real estate closing package to two email addresses. The closing 
package contains the names of two Massachusetts residents, their social security numbers, and 
mortgage loan numbers. Due to a typographical error in one of the email addresses (the omission 
of a middle initial), the email was sent to an unintended recipient email address. Further, while 
the Company’s Written Information Security Program requires that all documents containing 
personal information must be sent out in an encrypted fomi, this closing package was 
inadvertently sent in an unencrypted state. 

The Company has informed the two affected Massachusetts residents of the inclusion of 
the unintended recipient email address and is further providing them with the attached notice, 
which provides for an offer of credit monitoring services. The employee who sent the message 
has been disciplined and will undergo further training under the Company’s Written Information 
Security Program to ensure the proper handling of personal information going forward. The 
employee understands that any future failure to follow the Company’s Written Information 
Security Program may lead to immediate termination. 








On the morning of September 7, 2016, Ligris + Associates sent a follow up message to 
the email address to which the closing package was inadvertently sent, asking that the recipient 
refrain from opening the prior email and permanently delete it. At this time, there has been no 
response to the followup message and it is not clear if the unintended recipient email address is 
in active use. In any event, there is no evidence of which the Company is aware that would 
indicate that the above-described incident will lead to identity theft affecting the two 
Massachusetts residents. 

While we presume that this letter and the enclosed letter discharge the Company’s 
statutory notice requirement under the facts and circumstances of this matter, please contact me 
to provide any directives regarding required next steps and to address any questions or concerns 
you may have. Thank you. 


Sincerely yours. 







September 7, 2016 



We are writing to formally notify you that an unauthorized dissemination of your personal 
information occurred on September 6, 2016, as a result of a typographical error in the email 
address used to send your email, a real estate closing package. As you know, that closing 
package contained your name, address, social security number, and loan numbers. 

At our expense, Ligris + Associates will provide you with either two (2) years of credit 
monitoring or one (1) year of LifeLock protection, at your option. If you are interested in either 
option, please contact me and I will assist you in obtaining the services you choose. 

If you are the victim of identity theft, under Massachusetts law you have the right to file a police 
report and obtain a copy of it. 

Massachusetts law also allows consumers to place a security freeze on their credit reports. A 
security freeze prohibits a credit reporting agency from releasing any information from a 
consumer’s credit report without written authorization. However, please be aware that placing a 
security freeze on your credit report may delay, interfere with, or prevent the timely approval of 
any requests you make for new loans, credit mortgages, employment, housing or other services. 

If you have been a victim of identity theft, and you provide the credit reporting agency with a 
valid police report, it cannot charge you to place, lift or remove a security freeze. In all other 
cases, a credit reporting agency may charge you up to $5.00 each to place, temporarily lift, or 
permanently remove a security freeze. 

To place a security freeze on your credit report, you must send a written request to each of 
the three major consumer reporting agencies: Equifax (www.equifax.com); Experian 
(www.experian.com); and TransUnion (www.transunion.com) by regular, certified or 
overnight mail at the addresses below: 

Equifax Security Freeze, P.O. Box 105788, Atlanta, GA 30348 

Experian Security Freeze, P.O. Box 9554, Allen, TX 75013 

Trans Union Security Freeze Fraud Victim Assistance Department, P.O. Box 6790, 
Fullerton, CA 92834 


www.ligris.com 
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We are writing to formally notify you that an unauthorized dissemination of your personal 
information occurred on September 6, 2016, as a result of a typographical error in the email 
address used to send your email, a real estate closing package. As you know, that closing 
package contained your name, address, social security number, and loan numbers. 

At our expense, Ligris + Associates will provide you with either two (2) years of credit 
monitoring or one (1) year of LifeLock protection, at your option. If you are interested in either 
option, please contact me and I will assist you in obtaining the services you choose. 

If you are the victim of identity theft, under Massachusetts law you have the right to file a police 
report and obtain a copy of it. 

Massachusetts law also allows consumers to place a security freeze on their credit reports. A 
security freeze prohibits a credit reporting agency from releasing any information from a 
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www.ligris.com 
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In order to request a security freeze, you will need to provide the following information: 

1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.); 

2. Social Security Number; 

3. ' Date of birth; 

4. If you have moved in the past five (5) years, provide the addresses where you have lived 
over the prior five years; 

5. Proof of current address such as a current utility bill or telephone bill; 

6. A legible photocopy of a government issued identification card (state driver’s license or 
ID card, military identification, etc.); 

7. If you are a victim of identity theft, include a copy of either the police report, 
investigative report, or complaint to a law enforcement agency concerning identity theft; 
and 

8. If you are not a victim of identity theft, include payment by check, money order, or credit 
card (Visa, MasterCard, American Express or Discover only). Do not send cash through 
the mail. 

The credit reporting agencies have three (3) business days after receiving your request to place 
a security freeze on your credit report. The credit bureaus must also send written confirmation 
to you within five (5) business days and provide you with a unique personal identification 
number (PIN) or password, or both that can be used by you to authorize the removal or lifting 
of the security freeze. 

To lift the security freeze in order to allow a specific entity or individual access to your credit 
report, you must call or send a written request to the credit reporting agencies by mail and 
include proper identification (name, address, and social security number) and the PIN number 
or password provided to you when you placed the security freeze as well as the identities of 
those entities or individuals you would like to receive your credit report or the specific period of 
time you want the credit report available. The credit reporting agencies have three (3) business 
days after receiving your request to lift the security freeze for those identified entities or for the 
specified period of time. 

To remove the security freeze, you must send a written request to each of the three credit 
bureaus by mail and include proper identification (name, address, and social security number) 
and the PIN number or password provided to you when you placed the security freeze, The 
credit bureaus have three (3) business days after receiving your request to remove the security 
freeze. 
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If you should have any further questions, please contact me directly at 617.274.1500 
rpavne@liEris.com . 


Sincerely yours, 









September 7, 2016 


Dear 

We are writing to formally notify you that an unauthorized dissemination of your personal 
information occurred on September A^OHhasa result of a typographical error in the email 
address used to send your husband, a real estate closing package. As you know, that 

closing package contained your name, address, social security number, and loan numbers. 

At our expense, Ligris + Associates will provide you with either two (2) years of credit 
monitoring or one (1) year of LifeLock protection, at your option. If you are interested in either 
option, please contact me and I will assist you in obtaining the services you choose. 

If you are the victim of identity theft, under Massachusetts law you have the right to file a police 
report and obtain a copy of it. 

Massachusetts law also allows consumers to place a security freeze on their credit reports. A 
security freeze prohibits a credit reporting agency from releasing any information from a 
consumer’s credit report without written authorization. However, please be aware that placing a 
security freeze on your credit report may delay, interfere with, or prevent the timely approval of 
any requests you make for new loans, credit mortgages, employment, housing or other services. 

If you have been a victim of identity theft, and you provide the credit reporting agency with a 
valid police report, it cannot charge you to place, lift or remove a security freeze. In all other 
cases, a credit reporting agency may charge you up to $5.00 each to place, temporarily lift, or 
permanently remove a security freeze. 

To place a security freeze on your credit report, you must send a written request to each of 
the three major consumer reporting agencies: Equifax (www.equifax.com); Experian 
(www.experian.com); and TransUnion (www.transunion.com) by regular, certified or 
overnight mail at the addresses below: 

Equifax Security Freeze, P.O. Box 105788, Atlanta, GA 30348 

Experian Security Freeze, P.O. Box 9554, Allen, TX 75013 

Trans Union Security Freeze Fraud Victim Assistance Department, P.O. Box 6790, 
Fullerton, CA 92834 



www.ligris.com 
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In order to request a security freeze, you will need to provide the following information: 

1. Your full name (including middle initial as well as Jr., Sr., II, III, etc,); 

2. Social Security Number; 

3. Date of birth; 

4. If you have moved in the past five (5) years, provide the addresses where you have lived 
over the prior five years; 

5. Proof of current address such as a current utility bill or telephone bill; 

6. A legible photocopy of a government issued identification card (state driver’s license or 
ID card, military identification, etc.); 

7. If you are a victim of identity theft, include a copy of either the police report, 
investigative report, or complaint to a law enforcement agency concerning identity theft; 
and 

8. If you are not a victim of identity theft, include payment by check, money order, or credit 
card (Visa, MasterCard, American Express or Discover only). Do not send cash through 
the mail, 

The credit reporting agencies have three (3) business days after receiving your request to place 
a security freeze on your credit report. The credit bureaus must also send written confirmation 
to you within five (5) business days and provide you with a unique personal identification 
number (PIN) or password, or both that can be used by you to authorize the removal or lifting 
of the security freeze. 

To lift the security freeze in order to allow a specific entity or individual access to your credit 
report, you must call or send a written request to the credit reporting agencies by mail and 
include proper identification (name, address, and social security number) and the PIN number 
or password provided to you when you placed the security freeze as well as the identities of 
those entities or individuals you would like to receive your credit report or the specific period of 
time you want the credit report available. The credit reporting agencies have three (3) business 
days after receiving your request to lift the security freeze for those identified entities or for the 
specified period of time. 

To remove the security freeze, you must send a written request to each of the three credit 
bureaus by mail and include proper identification (name, address, and social security number) 
and the PIN number or password provided to you when you placed the security freeze. The 
credit bureaus have three (3) business days after receiving your request to remove the security 
freeze. 
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If you should have any further questions, please contact me directly at 617.274.1500 
rpavne@iigris.com . 


Sincerely yours, 


l/ ^ q 

/ Rick Payne, Esq. / 
Chief Legal Officer 


/R 























